Subject: Re: [ietf-dkim] DKIM on envelope level

From: Ian Eiloart <[email-masked]>
Date: Mon, 02 Nov 2009 11:20:35 +0000

--On 30 October 2009 19:52:54 +0100 Eliot Lear <[email-masked]> wrote:

>
> I can't say, but I do know that many of us toss a whole lot of mail at
> EHLO, some at MAIL FROM:<> and some at DATA.  The idea I was thinking
> about was whether it provides any value whatsoever to at least know that
> you are authentically dealing with a legitimate source sooner, without
> having to send even a whole header.

Yes it would help, but probably not more than an SPF pass would help. What 
do you get from that? Well, you can check the reputation of the MAIL FROM 
address. You can defer content scanning, and do it post SMTP because you 
can safely generate a bounce message if you've verified the MAIL FROM 
address.

Given that 90% of the messages that pass through my content scanners are 
accepted, that means that I'd reduce the live load on my content scanners 
by 90% if all the good guys were properly identifying themselves. Having 
said that, SPF passes would do the job much of the time.

I don't imagine that there's be much benefit in inspecting the headers 
before accepting the body, though.

-- 
Ian Eiloart
IT Services, University of Sussex
01273-873148 x3148
For new support requests, see http://www.sussex.ac.uk/its/help/
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Eliot Lear <[email-masked]>
Date: Mon, 02 Nov 2009 13:45:05 +0100

On 11/2/09 12:20 PM, Ian Eiloart wrote:
> Yes it would help, but probably not more than an SPF pass would help. 
> What do you get from that? Well, you can check the reputation of the 
> MAIL FROM address. 

Well now we're quibbling about how to check the MAIL FROM address.  I'm 
still interested in an end-to-end approach.  SPF doesn't give you 
end-to-end.  A legitimate intermediate could have been compromised, for 
instance.  MAIL FROM *does* change for mailing lists, of course, but 
then they should re-sign anyway.  Of course, I'm still not sure this is 
worth the effort to fix because SPF could be Just Good Enough for the 
1st pass, and then DKIM can be used on the body.  Same argument seems to 
apply to STARTTLS, although I would imagine that the latter has more of 
a hit on the CPU.

Eliot

---

From: Douglas Otis <[email-masked]>
Date: Mon, 02 Nov 2009 10:31:47 -0800

On 11/2/09 4:45 AM, Eliot Lear wrote:
>> --On 30 October 2009 19:52:54 +0100 Eliot Lear<[email-masked]>  wrote:
 >>

Agreed. SPF is not end-to-end. IMHO, hostname assessments should occur 
independently, where post processing of logs is used to create a history 
for every hostname received.  A hostname IP address tuple should be 
tracked upon receipt of valid messages (such as DKIM) from trusted 
domains.  When pruned to trusted domains, the data is kept rather small. 
  It would be beneficial to have a simple scheme with low overhead that 
allowed the extension of a trusted domain list, where one domain 
signifies trust in another domain.  Gaming of the system would need to 
be monitored and reported, of course.

This approach would enable rejection of abusive email early within the 
exchange without any modification to SMTP or DKIM, which would also help 
those with smaller networks.  By employing aggressive, and perhaps 
longish term rate limiting, this approach can be effective against 
bot-net generated traffic and against providers who setup junk outbound 
servers to avoiding being the entity rejecting traffic, and thereby 
avoid some of the related support calls.  An extensive trust list 
together with SMTP hostname assessment can provide better information 
than that from IP address reputation alone, and provide a way forward 
for IPv6.

-Doug

---

From: "Rolf E. Sonneveld" <[email-masked]>
Date: Mon, 02 Nov 2009 23:06:20 +0100

Eliot Lear wrote:
> then they should re-sign anyway.  

Well, on the envelope level there's not much that carries over from end 
to end, is there? The only thing that comes to mind is the MAIL FROM 
itself (with the remark made by Eliot, see above) and the use of DKIM in 
combination with something like BATV. This has been discussed before, 
see for example the thread "BATV pseudo-Last Call", e.g. 
http://www.imc.org/ietf-smtp/mail-archive/msg04856.html. I'm not sure 
about any definitive conclusions within that thread, maybe someone who 
participated in that thread can summarize.

> Of course, I'm still not sure this is 
> 1st pass, and then DKIM can be used on the body.  

I'm not convinced SPF is good enough for the 1st pass.

/rolf

---

From: Eliot Lear <[email-masked]>
Date: Tue, 03 Nov 2009 06:14:54 +0100

On 11/2/09 11:06 PM, Rolf E. Sonneveld wrote:
> Well, on the envelope level there's not much that carries over from 
> end to end, is there? The only thing that comes to mind is the MAIL 
> FROM itself (with the remark made by Eliot, see above) and the use of 
> DKIM in combination with something like BATV.

It's that MAIL FROM:<> that might be interesting (I still won't say for 
sure).

Eliot

---

From: Douglas Otis <[email-masked]>
Date: Tue, 03 Nov 2009 11:07:29 -0800

On 11/2/09 9:14 PM, Eliot Lear wrote:
>> Well, on the envelope level there's not much that carries over
>> from end to end, is there? The only thing that comes to mind is the
>> MAIL FROM itself (with the remark made by Eliot, see above) and the
>> use of DKIM in combination with something like BATV.
>
> It's that MAIL FROM:<>  that might be interesting (I still won't say
> for sure).

The general mindset is to consider email being sent along fixed paths,
as if being carried by imaginary Internet Mail Tubes.  Some want to
define these tubes by the Mail From, since that better accommodates
mailing lists.  Others want to see these tubes defined by the From
address as this could better mitigate fraud.  However, there remains the
problem created by mailing lists, which are not easily resolved by
attempts at combining a network of From and Mail From Tubes.

There needs to be a name based effort started where Hostnames, Mail
From, and DKIM signers are handled on a name basis.  Since email is not
actually carried by email Tubes along specific paths, and name to IP
address relationships is actually rather diverse.  The problem set
appears rather complex.  However, when viewed at the specific hostname,
there is no diversity, but instead elegant simplicity.  It appears EHLO
offers the _best_ means to control abuse at the envelope level by name.

So what EHLO names can be trusted?  Why not let originating domains
vote?  Why not let senders list in a scalable manner which names they
trusting to handle their Mail Tube.  This type of information would make
it easy for anyone to determine which names can be trusted, without
reliance upon a centralized authority.  In other words, no batteries
would be needed.

It seems that some providers are fearful of this approach, as this
places accountability on the entity actually handling the Mail Tube.
Providers need to stop trying to hide. Have their IP address and
hostname listed in Authentication-Results.  Allow originating domains an
ability to list all the other domains they trust to handle their Mail
Tube.  That way, in a manner fairly similar to that used by Google in
ordering search results, it will become obvious which domains are and
can be trusted to handle a mailing list or third-party signing responsibly.

-Doug